The CAPTCHA Is Changing and, for Many, Increasingly Invisible ⇥ wired.com

Reece Rogers, Wired:

As I browse the web in 2025, I rarely encounter captchas anymore. There’s no slanted text to discern. No image grid of stoplights to identify.

And on the rare occasion that I am asked to complete some bot-deterring task, the experience almost always feels surreal. A colleague shared recent tests where they were presented with images of dogs and ducks wearing hats, from bowler caps to French berets. The security questions ignored the animal’s hats, rudely, asking them to select the photos that showed animals with four legs.

This is true so long as you are not taking measures to protect your privacy by reducing tracking. Those measures might include built-in features like Safari’s cross-site tracking and iCloud Private Relay, or browser extensions like ad blockers. If you use any of those, you probably also see a fair number of bot-deterring puzzles you need to solve. Even something as simple as using advanced search parameters with Google might trip its bot detection features, perhaps not unfairly.

Hidden CAPTCHAs are not new. I dug into a dumb YouTube quasi-documentary about reCAPTCHA earlier this year and found both the V2 and V3 versions released by Google have mechanisms for remaining hidden most of the time.¹ This is true for a user with typical browser settings but, again, anyone using privacy-protection methods is more likely to be challenged with a puzzle or other task. CAPTCHAs are not going away, per se. The companies supplying the most popular ones — Cloudflare and Google — have among the greatest visibility into web traffic, and are using that to validate human users based on all the digital exhaust they collect.

Rogers:

Familiar challenge structures may also eventually go by the wayside. “While the classic visual puzzle is well-known, we are actively introducing new challenge types — like prompting a user to scan a QR code or perform a specific hand gesture,” says Google’s Knudsen. This allows the company to still add friction without confusing the user with an impossible task.

I am not turning on my webcam to do a gesture so I can access your website.